SQL injection vulnerability in SearchController

PMASA-2020-6

Announcement-ID: PMASA-2020-6

Date: 2020-10-10

Summary

SQL injection vulnerability in SearchController

Description

An SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.

Severity

We consider this flaw to be of moderate severity.

Affected Versions

phpMyAdmin 4.9.x releases prior to 4.9.6 and the 5.0.x releases prior to 5.0.3 are affected.

Solution

Upgrade to phpMyAdmin 4.9.6 or 5.0.3 or newer or apply patch listed below.

References

Thanks to André Sá from the SCA AppSec group at Checkmarx for reporting this vulnerability.

Assigned CVE ids: CVE-2020-26935

CWE ids: CWE-661

Patches

The following commits have been made to fix this issue:

• d09ab9bc9d634ad08b866d42bb8c4109869d38d2

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.